In today’s complex business world, information comes in various forms from various sources. A variety of data types, such as business, personal, or proprietary information, is processed everyday by organizations and collectively, organizations have been hoarding operational, and potentially sensitive, data for years. Holding onto this information can expose the organization to a few significant risks, but all can relate to one: legal risk. With any legal risk, we must understand that any bit of data could be subject to litigation, and thus, subject to a legal hold. On a basic level, most organizations understand what a legal hold is. Still, there are various functions and solutions that organizations should consider in how legal hold management needs to be handled.
Information Subject to Legal Holds
Certain types of data may be subject to a legal hold, but does the organization understand the whole nature of what will need to be preserved? Organizations need to consider the various data types that a preservation effort for litigation may involve:
- Documents and Contracts: Written or electronic documents, which may include agreements, contracts, official records, or an assortment of other documents.
- Employee Records: Personnel files, evaluations, communications, and other employee-related data.
- Emails and Correspondence: Any communication record, including emails or discussions.
- Short Messaging Service: Organizations are increasingly using short messaging services for chat, meetings, and sending additional documents. This may also include emojis that are being sent via short message service.
- Financial Records: Any financial data, accounting records, ledgers, invoices, or financial statements.
- Databases: Various servers and databases contain a vast amount of data, but also include how they are used via system logs
- Social Media Content: Information posted to social media websites and other online content may contain pertinent data.
- Metadata: The data about data must also be considered
This list is not exhaustive, but it shows one predominant issue: how do organizations find and preserve data that is subject to litigation and thus needs to be placed on legal hold?
There are different methods and solutions that organizations should consider in how to preserve relevant data potentially subject to litigation. Most important to data preservation, the organization must identify the basic functions and features they require of their legal hold management software.
First, let’s look at the processes of implementing a legal hold and how a preservation solution may be used.
The Legal Hold Process
At a minimum, the legal hold process for an organization should include:
- Initiation of the legal hold
- Notification
- Notify potential data custodians of the legal hold and provide instruction. Instructions should include an acknowledgment of compliance.
- Suspension of routine document destruction
- Ensure that necessary stakeholders are notified to halt and prevent routine document destruction. Identify the data owners in charge of relevant information via a data inventory.
- Early identification
- Identify and catalog potentially relevant data when litigation is anticipated.
- Clear communication
- Communicate the message that legal holds are important and provide clear instructions for compliance.
- Documentation
- Document the steps initiating the legal hold and the subsequent maintenance steps to ensure defensibility.
- Communication with legal hold custodians
- Clarity
- Send a clear message for the reasons and necessity of the legal hold, the expectations of the custodians, and their cooperation.
- Education
- Provide training and support to custodians to ensure they understand their obligations.
- Feedback loop
- Provide an open channel for custodians to provide feedback and report any issues with data preservation.
- Maintain a defensible legal hold process
- Regular audits
- Conduct periodical audits of the legal hold process to ensure continued compliance and effectiveness.
- Adaptions
- Keep an active, current data map to ensure that data systems and organization structure adapt accordingly to the legal hold requirements.
- Legal Counsel involvement
- Engage legal counsel to provide oversight and to ensure defensibility of the legal hold process.
- Preservation and identification of relevant data
- Relevant data
- All relevant data, including all electronic or physical records, must be preserved in accordance with potential litigation.
- Data Map
- Conduct a comprehensive data mapping exercise to identify sources and locations of potentially relevant data.
- Disposal suspension
- Organizations should temporarily suspend deletion of certain data types to ensure the preservation of relevant data.
- Work collaboratively
- Collaboratively engage with stakeholders within the organization, such as I.T. and any data custodians, to ensure compliance with a legal hold.
- Release of the legal hold
- End the preservation
- When the preservation ends, the legal hold may promptly be released.
- Notification
- Upon release of the legal hold, the custodians and other relevant stakeholders, such as I.T., should be notified and to resume routine document processing.
- End the preservation
- Relevant data
- Regular audits
- Clarity
- Notification
Effective Technical Solutions for Legal Hold Management
Understanding the basic legal hold process is just the start. The next questions is how do organizations use technology to implement a legal hold process? The following features of a technical legal hold solution can help organizations effectively and defensibly execute legal holds:
- Indexing-in-place
- An organization must understand what data it stores and where it’s located to identify potentially relevant data for a legal hold.
- Use technical solutions to create an effective “map of data” by connecting to the various systems within an organization that hold or process data, or end points.
- A best in class feature for technical solutions mapping data repositories is the ability to search within the connected end points for the relevant data that may be subject to a legal hold; i.e., not require duplicating or coping the data for search or indexing. Avoids unnecessary duplication of data outside of designated repository.
- Automate legal hold notices
- Notification is imperative to the legal hold process. From initiating to releasing the legal hold, regular communication with custodians and stakeholders is an absolute must.
- Software features automating dispatch of legal hold notices is critical for effective communication. The ability to track the notices, receive receipts, and process acknowledgments of the notice should be required as a best practice.
- Centralized data repository
- For data has identified as relevant for a legal hold, best practice to hold that information in a single data repository if possible.
- Attempting to preserve data subject to a legal hold spread among various systems introduces a substantial risk to accidental data disposal or spoilage. Collecting and storing relevant legal hold data in one repository is ideal.
- Best in class technical solutions hold the relevant data in one place and dispose of the relevant data once the legal hold closes to mitigate risks.
- Preservation of large data volumes
- Some organizations implement their legal hold process strictly through their I.T. Dept. and use various existing tools within their data storage systems.
- T. Depts. of organizations with large data volumes may find it impractical to handle the preservation efforts on their own using existing software. A legal hold technical solution with features designed to handle large data volumes for preservation will be much more efficient.
- Audit trail and reporting
- Documentation and auditing is required for the defensibility an organization’s legal hold process. The ability to demonstrate the steps and preservation efforts that an organization undertakes implementing their legal hold process can mitigate some legal risk associated with litigation.
- Look for legal hold software with documentation and audit reporting features to ensure reporting efforts are met, effectively and potentially automatically.
The proper legal hold process and technical solution for an organization are critical to risk management and compliance. Ensuring the correct solution not only protects and preserves data subject to litigation but also may lead to business efficiencies. With solutions including features like indexing-in-place, we’re seeing the evolution of legal hold solutions and dealing with the broader issue of understanding what type of data an organization has and where it’s located.
